104 days of lead time exposes the limits of reactive SOC defence

At a glance

What this is: Silent Push frames preemptive cyber defence as a way to detect adversary infrastructure earlier, with a reported average lead time of 104 days in one case study.

Why it matters: This matters because SOC teams, threat hunters, and identity programmes increasingly need earlier signal than post-compromise artefacts, especially where stolen credentials, exposed systems, or delegated access become attack entry points.

By the numbers:

• The case study reported an average early-detection lead time of 104 days before adversarial infrastructure was weaponised.

Context

SOC teams often see attackers only after compromise, when the usable evidence is already stale and the response window is shrinking. That makes reactive detection dependent on artifacts from a previous stage of the attack, not on the infrastructure the attacker is actively building.

The article argues for a shift toward preemptive cyber defence, where internet-scale context and earlier infrastructure mapping create a better chance of disruption before impact. For identity and access teams, the lesson is that trust decisions made too late are already operating inside the attacker’s timeline.

Key questions

Q: What breaks when SOC teams rely on patient-zero detection?

A: When detection depends on the first compromised victim, defenders learn after the attacker has already staged infrastructure and begun operational use. That creates a structural delay in triage, blocking, and investigation, because the security team is responding to evidence of a completed attack phase rather than the build-up that made it possible. The result is slower containment and weaker prevention.

Q: Why does earlier infrastructure visibility matter for threat response?

A: Earlier visibility shortens the time between adversary preparation and defensive action. If teams can see staging activity before weaponisation, they can block infrastructure, enrich alerts, and reduce the amount of post-compromise cleanup required. That matters most when campaigns reuse infrastructure or depend on predictable hosting patterns that can be disrupted before targets are hit.

Q: How should security teams measure whether preemptive defense is actually working?

A: Measure whether threat signals are being turned into blocked activity before launch, not just whether analysts are seeing more alerts. Good indicators include lead time before first victim impact, the number of campaigns disrupted upstream, and whether intelligence outputs are tied to enforcement points instead of only to dashboards.

Q: How do SIEM and SOAR workflows change when infrastructure intelligence is fed in early?

A: They shift from alert handling to context-driven decision-making. SIEM becomes the place where suspicious infrastructure is validated, and SOAR becomes the place where approved action can be automated. The practical change is less manual correlation and faster containment, because analysts are working with deterministic context instead of isolated indicators.

Technical breakdown

Why patient zero still shapes reactive detection

Reactive detection models still depend on a first observed victim, often called patient zero, before signatures, blocklists, or detections become useful. That means defenders are learning from the attacker’s completed activity rather than from the conditions that made the campaign possible. In practice, this creates a structural delay between compromise and visibility. The more an operation relies on historical artifacts, the more it favours campaigns that are short, distributed, or disposable. SOCs then spend their effort validating what already happened instead of interrupting the infrastructure that enables the next stage.

Practical implication: Treat patient-zero dependency as a detection architecture flaw, not a tuning problem.

How IOFA shifts detection from compromise to infrastructure

Indicators of Future Attack, or IOFA, are intended to identify adversary infrastructure during staging rather than after payload delivery. The mechanism matters because staging activity, domain registration patterns, hosting relationships, and behavioural links can all exist before the attacker uses them against a target. That changes the evidentiary model for SOC workflows: instead of asking whether an indicator is already malicious, teams ask whether the infrastructure is shaping up to support malicious use. This is especially relevant where attacker infrastructure may be reused across campaigns or linked through shared operational patterns. See the Threat Intelligence Guide.

Practical implication: Build detection and triage around pre-attack infrastructure patterns, not only known bad indicators.

Why SIEM integration matters for preemptive defence

A preemptive model only becomes operational when enrichment and context feed the tools analysts already use. The article describes IOFA and contextual data flowing into SIEM, SOAR, and TIP workflows, which matters because manual correlation is too slow for early-stage threat disruption. The technical shift is from isolated alerts to verifiable context that can be triaged, enriched, and acted on within existing workflows. That also means detection engineering has to evolve from event matching to context-based confidence assessment. The more deterministic the signal, the less time analysts spend proving that an alert is worth action. See the SOC Guide.

Practical implication: Integrate context-rich infrastructure intelligence into SOC workflows that can block or validate before escalation.

Threat narrative

Attacker objective: The attacker wants to operationalise infrastructure before defenders can block it, so the campaign reaches targets with less friction and more persistence.

1. Entry begins in the staging phase, where adversaries build infrastructure before they weaponise it against a target.
2. Escalation occurs as that infrastructure is prepared for campaign use, with the defender still seeing only indirect signals.
3. Impact follows once the infrastructure is used in a live attack, by which point the defender is reacting to a completed setup rather than interrupting it.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Reactive SOC architectures create a patient-zero dependency: if the first evidence of compromise is the point at which detection begins, defenders are already behind. That model fits historical signature-based security, but it fails against adversaries that stage infrastructure in advance and change it quickly. The practical consequence is that detection quality is being judged too late in the attack cycle, which weakens both response and governance.

Pre-attack infrastructure intelligence is becoming a control layer, not just a threat feed: the important distinction is not whether a feed is larger, but whether it explains why infrastructure is risky before it is used. That is the difference between descriptive indicators and predictive context. Teams that understand this shift can reduce time wasted on low-value alerts and focus on pre-weaponisation disruption.

Identity and access governance is part of the same timing problem: attackers often reach impact by abusing credentials, delegated access, or exposed systems after the infrastructure is ready. In that sense, SOC lead time and identity lead time are linked. If access decisions, revocation, and monitoring lag behind attacker staging, the control plane is reacting to yesterday’s threat rather than today’s setup.

Detection maturity now depends on feedback loops between investigation and prevention: the article’s strongest point is that every investigation should improve the next one. That is how organisations move from static correlation to compounding intelligence. The practitioner implication is to treat detections, enrichment, and blocking as one governance loop, not three separate teams.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Security Operations Metrics Guide

What this signals

Detection lead time is becoming a governance metric: if a SOC cannot see adversary infrastructure before it is weaponised, then the programme is measuring the wrong thing. The useful metric is not how many alerts were generated, but how much earlier the team can intervene and whether that lead time is improving over time.

Preemptive cyber defence is really a feedback architecture: the article’s core idea is that investigations should strengthen future blocking and enrichment, creating a compounding control loop. That model aligns with modern SOC maturity because it treats every case as reusable intelligence rather than a one-off incident.

Identity teams should read this as a timing warning: when attacker infrastructure is already in place, credentials, sessions, and delegated access become the fastest route to impact. The more delayed the visibility into hostile infrastructure, the more likely identity controls are to be exercised under attacker advantage.

For practitioners

• Map detections to pre-weaponisation infrastructure Prioritise domains, hosting patterns, and behavioural links that appear during attacker staging, before an incident reaches the perimeter.
• Wire contextual intelligence into SOC workflows Feed enrichment into SIEM and SOAR pipelines so analysts can validate suspicious infrastructure with deterministic facts instead of manual correlation.
• Use investigation findings to refine prevention Feed confirmed infrastructure patterns back into blocking, detection engineering, and triage rules so each case improves the next one.
• Measure lead time, not only alert volume Track how far in advance the team can see adversary infrastructure and whether that lead time reduces false positives and response drag.

Key takeaways

• Reactive SOC models leave defenders learning from patient zero, which means the attacker has usually already staged infrastructure and started to operationalise it.
• The article’s case study reports 104 days of average lead time, showing that earlier context can materially change how fast teams detect and block hostile infrastructure.
• Practitioners should treat pre-attack visibility as a control objective, linking detection engineering, enrichment, and blocking into a single feedback loop.

Related NHI Mgmt Group resources: Threat Hunting Guide · Security Operations Metrics Guide · SOC Guide

Key terms

• Preemptive Cybersecurity Defense: A security strategy that seeks to expose attacker intent before damage occurs. Instead of waiting for indicators of compromise, it places obstacles and decoys in the adversary’s path so their actions become visible earlier. The focus is on disrupting objectives such as persistence, lateral movement, and privilege escalation.
• Indicator Of Future Attack: An indicator of future attack is infrastructure, behaviour, or content that suggests an adversary is preparing a campaign before compromise is visible. It shifts detection from after the breach to before execution, which is critical for preemptive defense and AI-assisted triage.
• Patient Zero Dependency: A reactive detection pattern where defenders must first observe a compromised victim before they can generate useful detections or blocklists. This delays action until after the attacker has already moved through staging and into active use.
• Context graph: A persistent data layer that links telemetry with organisational knowledge such as asset ownership, tickets, prior investigations, and business workflows. It gives AI systems the context needed to interpret alerts correctly instead of guessing from isolated logs.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners building stronger access controls. It helps identity and security teams connect governance decisions to the broader security programme that depends on them.